linux-kernel - [PATCH] x86/microcode/amd: Don't attempt to load older microcode patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 31 Jan 2019 14:33:06 +0000
From:   "Lendacky, Thomas" <Thomas.Lendacky@....com>
To:     "x86@...nel.org" <x86@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:     Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        "H. Peter Anvin" <hpa@...or.com>
Subject: [PATCH] x86/microcode/amd: Don't attempt to load older microcode
 patch

The load_microcode_amd() function searches for microcode patches and
attempts to apply a microcode patch if is a different level than the
currently installed level. While the processor won't actually load a
level that is less than what is installed, the logic is followed as if
the patch should be installed. If the file-system contains an older
version of microcode than what is currently running, a late microcode
load check can result in the following messages:

x86/CPU: CPU features have changed after loading microcode, but might not take effect.
x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.

These messages were issued on a system where SME/SEV are not enabled by
the BIOS (MSR C001_0010[23] = 0b). During boot, early_detect_mem_encrypt()
is called and clears the SME and SEV features. However, after the (non)
late load of the firmware, get_cpu_cap() is called and resets the SME and
SEV features resulting in the messages.

Update the microcode level check to not attempt microcode loading if
the current level is greater than or equal to the patch level.

Signed-off-by: Tom Lendacky <thomas.lendacky@....com>
---
 arch/x86/kernel/cpu/microcode/amd.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 51adde0a0f1a..e1f3ba19ba54 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -855,7 +855,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
 	if (!p) {
 		return ret;
 	} else {
-		if (boot_cpu_data.microcode == p->patch_id)
+		if (boot_cpu_data.microcode >= p->patch_id)
 			return ret;

 		ret = UCODE_NEW;